“He said, ‘Well, I don’t think this is supposed to be in there,'” the boy’s mom, Jeanine Mulholland, told CBS6 Albany.

Mulholland called State Police, who are now investigating the incident. She also called the snacking company Graze that filled the order, which says they reviewed security footage of the box being packed and claim it wasn’t tampered with on their end.

The family started receiving Graze boxes six months ago. Now, Mulholland says she has her orders on hold.

“I’m going to second guess a lot of things now, especially food services, when I order in the mail,” she said. “Now, food services are so popular.”

Mulholland says she doesn’t blame the company, but she hopes they look at ways to make their packaging more difficult to tamper with so this doesn’t happen again to someone else. CBS6 Albany reached out to the post office and the U.S. Postal Inspection Service but got no response.